CLI Reference nfltr

Reference for nfltr.xyz users. Use this page for client-side nfltr commands that connect to the hosted relay: tunnels, sharing, messages and files between machines, and your account. The orchestration commands, nfltr orch and nfltr node, have their own reference on orch.nfltr.xyz.

New to NFLTR? Start with When to Use NFLTR, then return here for command-level detail.

Start From The Right Command Path

Goal	Start here	Next step
Give a hub a goal on nfltr.xyz	`claude mcp add nfltr -- nfltr mcp --toolset hub`	Agent Orchestration overview
Join a machine that runs agents	`nfltr node join --max-agents 2 --allow-all-tools`, with `CLAUDE_CODE_OAUTH_TOKEN` (from `claude setup-token`) or `ANTHROPIC_API_KEY` in the environment; a `claude login` alone is not used	Join machines
Monitor tasks & fleet	`nfltr orch task list --active` / `nfltr orch nodes list`	Many agents across machines
Secure transport or sharing	`nfltr http 8080`	Choose whether transport-only or orchestration-first is the right fit

After you choose a path, use the sections below as the deep command reference for flags, environment variables, examples, and operational details.

Installation

curl -fsSL https://nfltr.xyz/install.sh | sh -s -- --with orch installs nfltr and nfltr-orch: the orchestration commands (orch, node, mcp, ...) are nfltr-orch's, and nfltr runs it for them (it looks next to itself, then on PATH). Without --with orch you get the client commands only; nfltr update --apply --with orch adds nfltr-orch later, and nfltr update --apply keeps every installed binary current. Or download the binary for your platform from the landing page:

Platform	Binary
macOS (Apple Silicon)	`nfltr-darwin-arm64`
macOS (Intel)	`nfltr-darwin-amd64`
Linux (x86_64)	`nfltr-linux-amd64`
Linux (ARM64)	`nfltr-linux-arm64`
Windows (x86_64)	`nfltr-windows-amd64.exe`
Windows (ARM64)	`nfltr-windows-arm64.exe`

# Example: macOS Apple Silicon
chmod +x nfltr-darwin-arm64
sudo mv nfltr-darwin-arm64 /usr/local/bin/nfltr

Commands

Generated from the nfltr binary: every public command, its flags as --help prints them, and an example. Run nfltr <command> --help for the same text in your terminal.

nfltr http

Expose a local HTTP service

nfltr http <port> [flags]

Tutorials: Share a local app

Flag	Default	Description
`--acme-domain domain`	—	obtain Let's Encrypt certificate for domain (implies --e2ee; requires port 443 reachable)
`--allow-path /prefix`	—	forward only requests under this path /prefix (repeatable; e.g. a single webhook endpoint); any other path gets 404 without reaching the local service. Every path by default. Turns off end-to-end TLS, since the agent must see each request
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--basic-auth user:password`	`$NFLTR_BASIC_AUTH`	require HTTP Basic Auth user:password for all incoming requests (optional)
`--duration seconds`	—	maximum runtime in seconds (0=unlimited)
`--e2ee`	`true`	enable E2EE TLS termination (generates self-signed cert; clients connect via SNI router)
`--e2ee-cert file`	—	TLS certificate file for E2EE termination (implies --e2ee)
`--e2ee-key file`	—	TLS key file for E2EE termination (implies --e2ee)
`--health-addr address`	`:29501`	health check HTTP endpoint address
`--host-header Host`	`preserve`	Host your service gets: preserve (the public host the visitor asked for) or rewrite (your service's own host, for dev servers and virtual hosts that accept only that); X-Forwarded-Host carries the public host either way
`--http-addr address`	—	HTTP address of the relay for share and control-plane APIs
`--insecure-skip-verify`	—	skip TLS verification for local service
`--intercept`	—	live-print request/response summaries to stderr (traffic inspector); needs --mode inspectable
`--keepalive preset`	—	how the agent notices a relay gone silent: preset default, fast, nat, datacenter, mobile, or interval=<duration>,timeout=<duration> (default: default, dead within 15s; NFLTR_KEEPALIVE)
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--labels key=value`	—	comma-separated key=value labels for fleet matching (e.g. fleet=web,zone=us-east)
`--mode verified`	—	tunnel mode: verified, `inspectable` or `passthrough` (preferred over --e2ee). passthrough: the relay and the agent pass the client's TLS on to your HTTPS service, which holds the certificate for the share host name
`--name string`	`this machine's name`	agent identity (auto-generated if omitted)
`--no-share`	—	disable automatic share URL
`--record`	—	capture request/response traffic to a file for later replay; needs --mode inspectable
`--record-file file`	—	output file for captured traffic (default: nfltr-capture-<timestamp>.json)
`--retries attempts`	`12`	connection retry attempts
`--retry-wait seconds`	`5`	seconds between connection attempts once an outage passes a minute, doubling on repeated failures (a second at most before that)
`--route /prefix=port`	—	path route: /prefix=port or `/prefix=url` (repeatable); the prefix is stripped and the rest appended to the URL's path (/hook=http://localhost:9000/github sends /hook/x to /github/x); needs --mode inspectable
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--share`	`true`	request a public share URL after connecting (default: true)
`--share-auth user:password`	`$NFLTR_SHARE_AUTH`	HTTP Basic Auth user:password for share URL visitors
`--share-bearer token`	—	require Bearer token for share URL visitors
`--share-header Header=Value`	—	require HTTP Header=Value for share URL visitors (repeatable)
`--share-ip-allowlist IP/CIDR`	—	comma-separated IP/CIDR allowlist for share URL visitors
`--share-login`	—	share URL visitors must sign in to the relay's accounts as this machine's owner (or a --share-login-allow email); not with an agent certificate (--e2ee-cert, --acme-domain) or --mode passthrough
`--share-login-allow emails`	—	comma-separated emails a --share-login share also admits
`--share-preset public`	—	share workflow preset: public, `review`, or `webhook`
`--share-ttl duration`	—	how long the share URL lives without a visit, duration (for example 30m or 2h; default and cap: the relay's, 24h on nfltr.xyz); each visit starts it again
`--timeout seconds`	`60`	local service request timeout in seconds
`--tls`	`true`	enable TLS for the gRPC connection
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client certificate file for mTLS
`--tls-key file`	—	client key file for mTLS
`--transport transport`	—	how the agent's sessions reach the relay: transport tcp, quic, auto (tcp: link over TLS/TCP; quic: QUIC over UDP, TCP when it fails; auto: both raced, QUIC first); the gRPC stream when neither connects (default: tcp; NFLTR_TRANSPORT)
`--verbose`	—	enable verbose per-request logging

Example:

nfltr http 8080

nfltr tcp

Expose a local TCP port (SSH, databases, etc.)

nfltr tcp <port> [flags]

Tutorials: SSH to a machine behind NAT

Flag	Default	Description
`--acme-domain domain`	—	obtain Let's Encrypt certificate for domain (implies --e2ee; requires port 443 reachable)
`--allow-client fingerprint`	—	client key fingerprint allowed to open pinned sessions (repeatable or comma separated; each client prints its own with nfltr config client-key); an end-to-end encrypted tunnel needs one: the relay holds none, so it cannot reach the port
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--duration seconds`	—	maximum runtime in seconds (0=unlimited)
`--e2ee`	`true`	end-to-end TLS on this agent (a self-signed certificate; its fingerprint is printed): sessions must be pinned with tcp-connect/dial --pin, a session without --pin is refused (the relay could read it); --e2ee=false serves plain sessions only
`--e2ee-cert file`	—	TLS certificate file for E2EE termination (implies --e2ee)
`--e2ee-key file`	—	TLS key file for E2EE termination (implies --e2ee)
`--forward host:port`	—	forward TCP connections to host:port instead of localhost:<port>
`--keepalive preset`	—	how the agent notices a relay gone silent: preset default, fast, nat, datacenter, mobile, or interval=<duration>,timeout=<duration> (default: default, dead within 15s; NFLTR_KEEPALIVE)
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--labels key=value`	—	comma-separated key=value labels for fleet matching (e.g. fleet=web,zone=us-east)
`--name string`	`this machine's name`	agent identity
`--port port`	`-1`	local TCP port to expose (alternative to positional <port>; 0: none, with --forward)
`--retries attempts`	`12`	retry attempts
`--retry-wait seconds`	`5`	longest wait in seconds between connection attempts, before jitter (a second at most in an outage's first minute)
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--tls`	`true`	enable TLS
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client cert file for mTLS
`--tls-key file`	—	client key file for mTLS
`--transport transport`	—	how the agent's sessions reach the relay: transport tcp, quic, auto (tcp: link over TLS/TCP; quic: QUIC over UDP, TCP when it fails; auto: both raced, QUIC first); the gRPC stream when neither connects (default: tcp; NFLTR_TRANSPORT)
`--verbose`	—	verbose logging

Example:

nfltr tcp 22 --e2ee=false

nfltr tcp-connect

Connect to a remote agent's TCP service locally

nfltr tcp-connect <agent-name> <port> [flags]

Tutorials: SSH to a machine behind NAT

Flag	Default	Description
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--listen endpoint`	`:0`	local endpoint to listen on: host:port (e.g. :5432; a host-less :PORT binds 127.0.0.1, name a host such as 0.0.0.0 to serve other machines), unix:<path> (a 0600 socket in a directory only you can write to) or pipe:<name> (Windows named pipe, current user only)
`--pin fingerprint`	—	end-to-end encrypt every session: TLS with the agent, whose E2EE certificate must have this SHA-256 fingerprint (the agent prints it: nfltr up's banner and /status); the relay carries only ciphertext. A mismatch, or a service without E2EE, fails the session (dial: exit 7)
`--pin-cert fingerprint`	—	accept only the relay certificate with this SHA-256 fingerprint (as nfltr relay serve prints it; colons and a SHA256: prefix are optional). Without it a pin saved by nfltr config set-relay --cert-sha256 applies
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay address (host:port); grpc.<domain> is reached over HTTP at <domain>
`--tls`	`true`	use TLS for server connection
`--tls-cert file`	—	client certificate file the relay's mTLS identity provider authenticates (with --tls-key; no API key needed)
`--tls-key file`	—	client key file for --tls-cert
`--verbose`	—	log each connection's open and close (failures are always logged)

Example:

nfltr tcp-connect my-ssh 22 --listen :2222

nfltr dial

One session to a remote service on stdin/stdout, with JSON events and exit codes

nfltr dial <agent>/<service> | <agent> <port> [flags]

Flag	Default	Description
`--api-key-file file`	—	read the API key from this file (mode 0600 on Unix, or 0440 on a read-only mount such as a Kubernetes Secret volume; default $NFLTR_API_KEY_FILE)
`--exit-with-parent`	—	end the session and exit 8 when the process that started dial exits
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--open-timeout duration`	`10s`	give up opening the session after this duration; an offline agent is waited for until then (exit 3, else 5)
`--pin fingerprint`	—	end-to-end encrypt the session: TLS with the agent, whose E2EE certificate must have this SHA-256 fingerprint (from the agent: nfltr up's banner or /status); exit 7 on a mismatch
`--pin-cert fingerprint`	—	accept only the relay certificate with this SHA-256 fingerprint; without it a pin saved by nfltr config set-relay --cert-sha256 applies
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay address (host:port); grpc.<domain> is reached over HTTP at <domain>
`--tls`	`true`	use TLS for the relay connection

Example:

nfltr dial home/db < query.bin > answer.bin

nfltr up

Run several http and tcp services from one config file in one process

nfltr up [-c nfltr.yaml] [flags]

Tutorials: Share a local app

Flag	Default	Description
`--api-key-file file`	—	read the API key from this file (mode 0600 on Unix, or 0440 on a read-only mount such as a Kubernetes Secret volume; default $NFLTR_API_KEY_FILE)
`--c file`	`nfltr.yaml`	services config file
`--config file`	`nfltr.yaml`	services config file (same as -c)
`--drain long`	`5s`	at shutdown, let open connect: sessions and the open sessions of published services run this long before closing them (services leave the relay at once)
`--exit-with-parent`	—	stop everything and exit 8 when the process that started nfltr up exits
`--http-addr address`	—	HTTP address of the relay for share URLs and connect: sessions
`--key-name string`	—	use a named API key from config for every service (see 'nfltr config list-api-keys')
`--log-format string`	`text`	connect: events on stderr: text or json (one JSON object per line, as nfltr dial)
`--open-timeout long`	`10s`	a connect: session that has not opened after this long fails (code unreachable); an offline agent is waited for until then (code not_found)
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port) for every service

Example:

nfltr up

nfltr a2a

Agent-to-agent communication (send, listen, recv, pipe, list)

nfltr a2a <command> [flags]

Tutorials: Send files and messages between machines · End-to-end encryption and pairing keys

Command	Description
`nfltr a2a send`	Send a message to another agent (unary RPC)
`nfltr a2a listen`	Listen for incoming A2A calls (print to stdout)
`nfltr a2a recv`	Receive incoming A2A messages (receive-only, no echo)
`nfltr a2a pipe`	Bidirectional stdin/stdout streaming (like netcat)
`nfltr a2a list`	List connected agents

nfltr a2a send

Send a message to another agent (unary RPC)

nfltr a2a send <target> [message]

Flag	Default	Description
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--e2ee-key-file file`	—	A2A end-to-end key file (default: this machine's <config dir>/a2a-root.key, else a2a-machine.key; the hub makes its root on first start, `nfltr orch hub machines add <machine> --out <file>` another machine's) (env NFLTR_A2A_E2EE_KEY_FILE)
`--heartbeat-interval interval`	—	app-level A2A heartbeat send interval (e.g. 60s). 0 = use the rpcclient default (15s). The stall watchdog cancels the connection when sendLoop hasn't shipped any frame for 2× this interval; bump it on networks where docker NAT or HTTP/2 backpressure can stall sends past 30s (symptom: repeated `code = Canceled` flap every 30-90s).
`--json`	—	emit response as a JSON object {sent_to, status, payload, latency_ms}
`--keepalive preset`	—	how the agent notices a relay gone silent: preset default, fast, nat, datacenter, mobile, or interval=<duration>,timeout=<duration> (default: default, dead within 15s; NFLTR_KEEPALIVE)
`--keepalive-time interval`	—	gRPC client keepalive ping interval (e.g. 30s). 0 = use the rpcclient default (60s). At least 30s: relays end a connection pinged more often (GOAWAY too_many_pings); for faster detection use --keepalive.
`--keepalive-timeout timeout`	—	gRPC client keepalive ACK timeout. 0 = use the rpcclient default (20s). Lower values declare a connection dead faster after a real drop. Pair with --keepalive-time.
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--name string`	`this machine's name`	agent identity
`--retries attempts`	`12`	retry attempts
`--retry-wait seconds`	`5`	seconds between connection attempts once an outage passes a minute, doubling on repeated failures (a second at most before that)
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--timeout timeout`	`30s`	client-side send request timeout (e.g. 30s, 1m)
`--timeout-sec seconds`	`30`	request timeout in seconds (legacy; prefer --timeout)
`--tls`	`true`	enable TLS
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client cert file for mTLS
`--tls-key file`	—	client key file for mTLS

Example:

nfltr a2a send sensor-42 "get status"

nfltr a2a listen

Listen for incoming A2A calls (print to stdout)

nfltr a2a listen

Flag	Default	Description
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--e2ee-key-file file`	—	A2A end-to-end key file (default: this machine's <config dir>/a2a-root.key, else a2a-machine.key; the hub makes its root on first start, `nfltr orch hub machines add <machine> --out <file>` another machine's) (env NFLTR_A2A_E2EE_KEY_FILE)
`--echo`	`true`	echo received messages back to sender
`--exec command`	—	execute command for each call (stdin=request, stdout=response)
`--heartbeat-interval interval`	—	app-level A2A heartbeat send interval (e.g. 60s). 0 = use the rpcclient default (15s). The stall watchdog cancels the connection when sendLoop hasn't shipped any frame for 2× this interval; bump it on networks where docker NAT or HTTP/2 backpressure can stall sends past 30s (symptom: repeated `code = Canceled` flap every 30-90s).
`--keepalive preset`	—	how the agent notices a relay gone silent: preset default, fast, nat, datacenter, mobile, or interval=<duration>,timeout=<duration> (default: default, dead within 15s; NFLTR_KEEPALIVE)
`--keepalive-time interval`	—	gRPC client keepalive ping interval (e.g. 30s). 0 = use the rpcclient default (60s). At least 30s: relays end a connection pinged more often (GOAWAY too_many_pings); for faster detection use --keepalive.
`--keepalive-timeout timeout`	—	gRPC client keepalive ACK timeout. 0 = use the rpcclient default (20s). Lower values declare a connection dead faster after a real drop. Pair with --keepalive-time.
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--name string`	`this machine's name`	agent identity
`--prefix`	`true`	prefix each line with [source-agent]
`--retries attempts`	`12`	retry attempts
`--retry-wait seconds`	`5`	seconds between connection attempts once an outage passes a minute, doubling on repeated failures (a second at most before that)
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--timeout timeout`	`30s`	client-side send request timeout (e.g. 30s, 1m)
`--timeout-sec seconds`	`30`	request timeout in seconds (legacy; prefer --timeout)
`--tls`	`true`	enable TLS
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client cert file for mTLS
`--tls-key file`	—	client key file for mTLS

Example:

nfltr a2a listen --name responder

nfltr a2a recv

Receive incoming A2A messages (receive-only, no echo)

nfltr a2a recv

Flag	Default	Description
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--count n`	—	exit after receiving n messages (0 = unlimited)
`--e2ee-key-file file`	—	A2A end-to-end key file (default: this machine's <config dir>/a2a-root.key, else a2a-machine.key; the hub makes its root on first start, `nfltr orch hub machines add <machine> --out <file>` another machine's) (env NFLTR_A2A_E2EE_KEY_FILE)
`--heartbeat-interval interval`	—	app-level A2A heartbeat send interval (e.g. 60s). 0 = use the rpcclient default (15s). The stall watchdog cancels the connection when sendLoop hasn't shipped any frame for 2× this interval; bump it on networks where docker NAT or HTTP/2 backpressure can stall sends past 30s (symptom: repeated `code = Canceled` flap every 30-90s).
`--json`	—	emit each message as a JSON object {from, payload}
`--keepalive preset`	—	how the agent notices a relay gone silent: preset default, fast, nat, datacenter, mobile, or interval=<duration>,timeout=<duration> (default: default, dead within 15s; NFLTR_KEEPALIVE)
`--keepalive-time interval`	—	gRPC client keepalive ping interval (e.g. 30s). 0 = use the rpcclient default (60s). At least 30s: relays end a connection pinged more often (GOAWAY too_many_pings); for faster detection use --keepalive.
`--keepalive-timeout timeout`	—	gRPC client keepalive ACK timeout. 0 = use the rpcclient default (20s). Lower values declare a connection dead faster after a real drop. Pair with --keepalive-time.
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--name string`	`this machine's name`	agent identity
`--prefix`	`true`	prefix each line with [source-agent]
`--recv-timeout duration`	—	exit with code 2 after this duration if no message arrives (e.g. 200ms, 5s); 0 = wait indefinitely
`--retries attempts`	`12`	retry attempts
`--retry-wait seconds`	`5`	seconds between connection attempts once an outage passes a minute, doubling on repeated failures (a second at most before that)
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--timeout timeout`	`30s`	client-side send request timeout (e.g. 30s, 1m)
`--timeout-sec seconds`	`30`	request timeout in seconds (legacy; prefer --timeout)
`--tls`	`true`	enable TLS
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client cert file for mTLS
`--tls-key file`	—	client key file for mTLS
`--types filter`	—	comma-separated message-type filter (e.g. a2a-request,task.*); empty = all

Example:

nfltr a2a recv --name inbox

nfltr a2a pipe

Bidirectional stdin/stdout streaming (like netcat)

nfltr a2a pipe <target>

Flag	Default	Description
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--e2ee-key-file file`	—	A2A end-to-end key file (default: this machine's <config dir>/a2a-root.key, else a2a-machine.key; the hub makes its root on first start, `nfltr orch hub machines add <machine> --out <file>` another machine's) (env NFLTR_A2A_E2EE_KEY_FILE)
`--heartbeat-interval interval`	—	app-level A2A heartbeat send interval (e.g. 60s). 0 = use the rpcclient default (15s). The stall watchdog cancels the connection when sendLoop hasn't shipped any frame for 2× this interval; bump it on networks where docker NAT or HTTP/2 backpressure can stall sends past 30s (symptom: repeated `code = Canceled` flap every 30-90s).
`--keepalive preset`	—	how the agent notices a relay gone silent: preset default, fast, nat, datacenter, mobile, or interval=<duration>,timeout=<duration> (default: default, dead within 15s; NFLTR_KEEPALIVE)
`--keepalive-time interval`	—	gRPC client keepalive ping interval (e.g. 30s). 0 = use the rpcclient default (60s). At least 30s: relays end a connection pinged more often (GOAWAY too_many_pings); for faster detection use --keepalive.
`--keepalive-timeout timeout`	—	gRPC client keepalive ACK timeout. 0 = use the rpcclient default (20s). Lower values declare a connection dead faster after a real drop. Pair with --keepalive-time.
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--line`	—	send each stdin line as a separate message
`--name string`	`this machine's name`	agent identity
`--retries attempts`	`12`	retry attempts
`--retry-wait seconds`	`5`	seconds between connection attempts once an outage passes a minute, doubling on repeated failures (a second at most before that)
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--timeout timeout`	`30s`	client-side send request timeout (e.g. 30s, 1m)
`--timeout-sec seconds`	`30`	request timeout in seconds (legacy; prefer --timeout)
`--tls`	`true`	enable TLS
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client cert file for mTLS
`--tls-key file`	—	client key file for mTLS
`--to target`	—	relay target agent name (alternative to positional arg)

Example:

nfltr a2a pipe sensor-42

nfltr a2a list

List connected agents

nfltr a2a list

Flag	Default	Description
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--e2ee-key-file file`	—	A2A end-to-end key file (default: this machine's <config dir>/a2a-root.key, else a2a-machine.key; the hub makes its root on first start, `nfltr orch hub machines add <machine> --out <file>` another machine's) (env NFLTR_A2A_E2EE_KEY_FILE)
`--filter-flavor string`	—	only show agents with matching nfltr.worker.flavor label
`--heartbeat-interval interval`	—	app-level A2A heartbeat send interval (e.g. 60s). 0 = use the rpcclient default (15s). The stall watchdog cancels the connection when sendLoop hasn't shipped any frame for 2× this interval; bump it on networks where docker NAT or HTTP/2 backpressure can stall sends past 30s (symptom: repeated `code = Canceled` flap every 30-90s).
`--json`	—	output as JSON
`--keepalive preset`	—	how the agent notices a relay gone silent: preset default, fast, nat, datacenter, mobile, or interval=<duration>,timeout=<duration> (default: default, dead within 15s; NFLTR_KEEPALIVE)
`--keepalive-time interval`	—	gRPC client keepalive ping interval (e.g. 30s). 0 = use the rpcclient default (60s). At least 30s: relays end a connection pinged more often (GOAWAY too_many_pings); for faster detection use --keepalive.
`--keepalive-timeout timeout`	—	gRPC client keepalive ACK timeout. 0 = use the rpcclient default (20s). Lower values declare a connection dead faster after a real drop. Pair with --keepalive-time.
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--name string`	`this machine's name`	agent identity
`--retries attempts`	`12`	retry attempts
`--retry-wait seconds`	`5`	seconds between connection attempts once an outage passes a minute, doubling on repeated failures (a second at most before that)
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--timeout timeout`	`30s`	client-side send request timeout (e.g. 30s, 1m)
`--timeout-sec seconds`	`30`	request timeout in seconds (legacy; prefer --timeout)
`--tls`	`true`	enable TLS
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client cert file for mTLS
`--tls-key file`	—	client key file for mTLS

Example:

nfltr a2a list

nfltr p2p

Peer-to-peer direct transfer (send, recv, chat, call, list)

nfltr p2p <command> [flags]

Tutorials: Send files and messages between machines

Command	Description
`nfltr p2p send`	Send a file or directory to a peer
`nfltr p2p recv`	Receive an incoming P2P transfer
`nfltr p2p chat`	Interactive P2P text chat
`nfltr p2p call`	Audio/video call (opens browser)
`nfltr p2p list`	List connected peers

nfltr p2p send

Send a file or directory to a peer

nfltr p2p send <file|dir> <peer-agent-id>

Flag	Default	Description
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--e2ee-key-file file`	—	pairing key file (at least 32 random bytes, e.g. openssl rand -hex 32) that authenticates end-to-end keys so the relay cannot sit in the middle: the same file on every machine (env NFLTR_A2A_E2EE_KEY_FILE)
`--force-relay`	—	skip direct P2P and always use server relay
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--name string`	`this machine's name`	agent ID used during this session
`--retries int`	`5`	connection retry attempts
`--retry-wait int`	`3`	longest wait in seconds between connection attempts, before jitter (a second at most in an outage's first minute); also the wait between checks for a peer that has not connected
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	gRPC server address
`--stun string`	`$STUN_SERVER, else stun.l.google.com:19302 with nfltr.xyz, none with your own relay`	STUN server for external address discovery
`--tls`	`true`	enable TLS for gRPC
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client cert file for mTLS
`--tls-key file`	—	client key file for mTLS
`--turn url`	—	your own TURN urls for calls and file transfers (comma-separated; credentials from NFLTR_TURN_USERNAME and NFLTR_TURN_CREDENTIAL); default: the TURN the relay offers, if any

Example:

nfltr p2p send report.pdf bob-laptop

nfltr p2p recv

Receive an incoming P2P transfer

nfltr p2p recv [--from <agent-id>]

Flag	Default	Description
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--e2ee-key-file file`	—	pairing key file (at least 32 random bytes, e.g. openssl rand -hex 32) that authenticates end-to-end keys so the relay cannot sit in the middle: the same file on every machine (env NFLTR_A2A_E2EE_KEY_FILE)
`--force-relay`	—	skip direct P2P and always use server relay
`--from string`	—	only accept transfers from this agent ID
`--keep`	—	keep listening for multiple transfers
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--name string`	`this machine's name`	agent ID used during this session
`--no-browser`	—	print URL instead of opening browser
`--output string`	`.`	directory to write received files
`--retries int`	`5`	connection retry attempts
`--retry-wait int`	`3`	longest wait in seconds between connection attempts, before jitter (a second at most in an outage's first minute); also the wait between checks for a peer that has not connected
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	gRPC server address
`--stun string`	`$STUN_SERVER, else stun.l.google.com:19302 with nfltr.xyz, none with your own relay`	STUN server for external address discovery
`--tls`	`true`	enable TLS for gRPC
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client cert file for mTLS
`--tls-key file`	—	client key file for mTLS
`--turn url`	—	your own TURN urls for calls and file transfers (comma-separated; credentials from NFLTR_TURN_USERNAME and NFLTR_TURN_CREDENTIAL); default: the TURN the relay offers, if any

Example:

nfltr p2p recv --name bob-laptop --output /tmp/received/

nfltr p2p chat

Interactive P2P text chat

nfltr p2p chat <peer-agent-id>

Flag	Default	Description
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--e2ee-key-file file`	—	pairing key file (at least 32 random bytes, e.g. openssl rand -hex 32) that authenticates end-to-end keys so the relay cannot sit in the middle: the same file on every machine (env NFLTR_A2A_E2EE_KEY_FILE)
`--force-relay`	—	skip direct P2P and always use server relay
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--name string`	`this machine's name`	agent ID used during this session
`--retries int`	`5`	connection retry attempts
`--retry-wait int`	`3`	longest wait in seconds between connection attempts, before jitter (a second at most in an outage's first minute); also the wait between checks for a peer that has not connected
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	gRPC server address
`--stun string`	`$STUN_SERVER, else stun.l.google.com:19302 with nfltr.xyz, none with your own relay`	STUN server for external address discovery
`--tls`	`true`	enable TLS for gRPC
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client cert file for mTLS
`--tls-key file`	—	client key file for mTLS

Example:

nfltr p2p chat bob-laptop

nfltr p2p call

Audio/video call (opens browser)

nfltr p2p call <peer-agent-id>

Flag	Default	Description
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--e2ee-key-file file`	—	pairing key file (at least 32 random bytes, e.g. openssl rand -hex 32) that authenticates end-to-end keys so the relay cannot sit in the middle: the same file on every machine (env NFLTR_A2A_E2EE_KEY_FILE)
`--force-relay`	—	skip direct P2P and always use server relay
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--name string`	`this machine's name`	agent ID used during this session
`--no-browser`	—	print URL instead of opening browser
`--retries int`	`5`	connection retry attempts
`--retry-wait int`	`3`	longest wait in seconds between connection attempts, before jitter (a second at most in an outage's first minute); also the wait between checks for a peer that has not connected
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	gRPC server address
`--stun string`	`$STUN_SERVER, else stun.l.google.com:19302 with nfltr.xyz, none with your own relay`	STUN server for external address discovery
`--tls`	`true`	enable TLS for gRPC
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client cert file for mTLS
`--tls-key file`	—	client key file for mTLS
`--turn url`	—	your own TURN urls for calls and file transfers (comma-separated; credentials from NFLTR_TURN_USERNAME and NFLTR_TURN_CREDENTIAL); default: the TURN the relay offers, if any

Example:

nfltr p2p call bob-laptop

nfltr p2p list

List connected peers

nfltr p2p list

Flag	Default	Description
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--e2ee-key-file file`	—	pairing key file (at least 32 random bytes, e.g. openssl rand -hex 32) that authenticates end-to-end keys so the relay cannot sit in the middle: the same file on every machine (env NFLTR_A2A_E2EE_KEY_FILE)
`--filter string`	—	case-insensitive substring filter on agent_id
`--force-relay`	—	skip direct P2P and always use server relay
`--json`	—	output as JSON
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--name string`	`this machine's name`	agent ID used during this session
`--retries int`	`5`	connection retry attempts
`--retry-wait int`	`3`	longest wait in seconds between connection attempts, before jitter (a second at most in an outage's first minute); also the wait between checks for a peer that has not connected
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	gRPC server address
`--stun string`	`$STUN_SERVER, else stun.l.google.com:19302 with nfltr.xyz, none with your own relay`	STUN server for external address discovery
`--tls`	`true`	enable TLS for gRPC
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client cert file for mTLS
`--tls-key file`	—	client key file for mTLS

Example:

nfltr p2p list

nfltr command

Expose a local CLI command as an HTTP endpoint

nfltr command <cmd> [args...] [flags]

Tutorials: Share a log file or command output

Flag	Default	Description
`--acme-domain domain`	—	obtain Let's Encrypt certificate for domain (implies --e2ee; requires port 443 reachable)
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--basic-auth user:password`	`$NFLTR_BASIC_AUTH`	require HTTP Basic Auth user:password
`--body-as-arg flag`	—	pass POST body as a command flag instead of stdin (e.g. -p)
`--capability value`	—	additional capability identifier to advertise on the shared tunnel (repeatable, for example --capability terminal)
`--concurrency int`	`10`	max concurrent command executions
`--cwd directory`	—	working directory for the command
`--e2ee`	`true`	enable E2EE TLS termination (generates self-signed cert; clients connect via SNI router)
`--e2ee-cert file`	—	TLS certificate file for E2EE termination (implies --e2ee)
`--e2ee-key file`	—	TLS key file for E2EE termination (implies --e2ee)
`--http-addr address`	—	HTTP address of the relay for the --share API
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--labels key=value`	—	comma-separated key=value labels for fleet matching
`--max-input bytes`	`1048576`	maximum request body size in bytes
`--model model`	—	default AI model (overridable from UI via X-Model header)
`--name string`	`this machine's name`	agent identity
`--no-share`	—	disable automatic share URL (overrides --share)
`--retries attempts`	`12`	connection retry attempts
`--retry-wait seconds`	`5`	seconds between connection attempts once an outage passes a minute, doubling on repeated failures (a second at most before that)
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--share`	`true`	request a public share URL (default: true; use --no-share to disable)
`--tcp-forward host:port`	—	optional local TCP host:port exposed through the same agent identity (for example localhost:22 or localhost:3389)
`--timeout seconds`	`120`	command execution timeout in seconds
`--tls`	`true`	enable TLS for the gRPC connection
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client certificate file for mTLS
`--tls-key file`	—	client key file for mTLS

Example:

nfltr command cat

nfltr tail

Stream a file's live output via a public URL (tail -f)

nfltr tail <file> [flags]

Tutorials: Share a log file or command output

Flag	Default	Description
`--acme-domain domain`	—	obtain Let's Encrypt certificate for domain (implies --e2ee; requires port 443 reachable)
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--basic-auth user:password`	`$NFLTR_BASIC_AUTH`	require HTTP Basic Auth user:password
`--capability value`	—	additional capability identifier to advertise on the shared tunnel (repeatable, for example --capability terminal)
`--e2ee`	`true`	enable E2EE TLS termination (generates self-signed cert; clients connect via SNI router)
`--e2ee-cert file`	—	TLS certificate file for E2EE termination (implies --e2ee)
`--e2ee-key file`	—	TLS key file for E2EE termination (implies --e2ee)
`--http-addr address`	—	HTTP address of the relay for the --share API
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--labels key=value`	—	comma-separated key=value labels for fleet matching
`--lines lines`	`50`	number of trailing lines to show initially
`--name string`	`this machine's name`	agent identity
`--no-share`	—	disable automatic share URL
`--retries attempts`	`12`	connection retry attempts
`--retry-wait seconds`	`5`	seconds between connection attempts once an outage passes a minute, doubling on repeated failures (a second at most before that)
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--share`	`true`	request a public share URL
`--tcp-forward host:port`	—	optional local TCP host:port exposed through the same agent identity (for example localhost:22 or localhost:3389)
`--tls`	`true`	enable TLS for the gRPC connection
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client certificate file for mTLS
`--tls-key file`	—	client key file for mTLS

Example:

nfltr tail /var/log/syslog

nfltr wg

WireGuard VPN tunnel to an agent's LAN (serve, connect, socks5, keygen)

nfltr wg <command> [flags]

Tutorials: Reach a private LAN

Command	Description
`nfltr wg serve`	Run as a WireGuard agent that forwards to the --allow destinations
`nfltr wg connect`	Route CIDRs to an agent's LAN over a kernel TUN (Linux, CAP_NET_ADMIN)
`nfltr wg socks5`	Start a SOCKS5 proxy through a WireGuard tunnel
`nfltr wg keygen`	Generate a new WireGuard key pair

nfltr wg serve

Run as a WireGuard agent that forwards to the --allow destinations

nfltr wg serve --allow DEST[,DEST]

Flag	Default	Description
`--allow string`	—	required: comma-separated destinations tunnel traffic may reach: CIDR, IP or host, each optionally :port (e.g. 192.168.1.0/24,10.0.0.5:5432), or "all" (everything but this machine's localhost, which needs an explicit 127.0.0.1:port or localhost:port)
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--duration seconds`	—	maximum runtime in seconds (0=unlimited)
`--e2ee-key-file file`	—	pairing key file (at least 32 random bytes, e.g. openssl rand -hex 32) that authenticates end-to-end keys so the relay cannot sit in the middle: the same file on every machine (env NFLTR_A2A_E2EE_KEY_FILE)
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--labels key=value`	—	comma-separated key=value labels for fleet matching
`--name string`	`this machine's name`	agent identity
`--private-key string`	`$WG_PRIVATE_KEY`	WireGuard private key (base64); generates ephemeral key if empty
`--retries attempts`	`12`	retry attempts
`--retry-wait seconds`	`5`	longest wait in seconds between connection attempts, before jitter (a second at most in an outage's first minute)
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--tls`	`true`	enable TLS
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client cert file for mTLS
`--tls-key file`	—	client key file for mTLS
`--verbose`	—	verbose logging

Example:

nfltr wg serve --name my-server --allow 192.168.1.0/24

nfltr wg connect

Route CIDRs to an agent's LAN over a kernel TUN (Linux, CAP_NET_ADMIN)

nfltr wg connect <agent-name> --allowed-ips CIDR

Flag	Default	Description
`--allowed-ips string`	—	required: comma-separated CIDRs to route through the tunnel (e.g. 192.168.1.0/24)
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--e2ee-key-file file`	—	pairing key file (at least 32 random bytes, e.g. openssl rand -hex 32) that authenticates end-to-end keys so the relay cannot sit in the middle: the same file on every machine (env NFLTR_A2A_E2EE_KEY_FILE)
`--keepalive preset`	—	how the agent notices a relay gone silent: preset default, fast, nat, datacenter, mobile, or interval=<duration>,timeout=<duration> (default: default, dead within 15s; NFLTR_KEEPALIVE)
`--key-name string`	—	use a named API key from config
`--private-key string`	—	WireGuard private key (base64); generates ephemeral key if empty
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--tls`	`true`	use TLS for server connection

Example:

nfltr wg connect my-server --allowed-ips 192.168.1.0/24

nfltr wg socks5

Start a SOCKS5 proxy through a WireGuard tunnel

nfltr wg socks5 <agent-name>

Flag	Default	Description
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--e2ee-key-file file`	—	pairing key file (at least 32 random bytes, e.g. openssl rand -hex 32) that authenticates end-to-end keys so the relay cannot sit in the middle: the same file on every machine (env NFLTR_A2A_E2EE_KEY_FILE)
`--keepalive preset`	—	how the agent notices a relay gone silent: preset default, fast, nat, datacenter, mobile, or interval=<duration>,timeout=<duration> (default: default, dead within 15s; NFLTR_KEEPALIVE)
`--key-name string`	—	use a named API key from config
`--listen address`	`:1080`	local SOCKS5 address to listen on (a host-less :PORT binds 127.0.0.1; name a host such as 0.0.0.0 to serve other machines)
`--private-key string`	—	WireGuard private key (base64); generates ephemeral key if empty
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--tls`	`true`	use TLS for server connection

Example:

nfltr wg socks5 my-server --listen :1080

nfltr wg keygen

Generate a new WireGuard key pair

nfltr wg keygen

Example:

nfltr wg keygen

nfltr shell

Embedded SSH server (no sshd required, exposed via tunnel)

nfltr shell [flags]

Tutorials: SSH to a machine behind NAT

Flag	Default	Description
`--acme-domain domain`	—	obtain Let's Encrypt certificate for domain (implies --e2ee; requires port 443 reachable)
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--authorized-keys file`	—	path to authorized_keys file for public key auth
`--e2ee`	`true`	enable E2EE TLS termination (generates self-signed cert; clients connect via SNI router)
`--e2ee-cert file`	—	TLS certificate file for E2EE termination (implies --e2ee)
`--e2ee-key file`	—	TLS key file for E2EE termination (implies --e2ee)
`--host-key file`	—	path to SSH host key file (PEM); auto-generated if empty
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--labels key=value`	—	comma-separated key=value labels for fleet matching
`--name string`	`this machine's name`	agent identity
`--no-auth`	—	disable all SSH authentication (smoke tests only)
`--password password`	`$NFLTR_SHELL_PASSWORD`	SSH password for password authentication
`--retries attempts`	`12`	retry attempts
`--retry-wait seconds`	`5`	longest wait in seconds between connection attempts, before jitter (a second at most in an outage's first minute)
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--shell command`	—	shell command to spawn (default: $SHELL or /bin/sh)
`--tls`	`true`	enable TLS
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client cert file for mTLS
`--tls-key file`	—	client key file for mTLS
`--verbose`	—	verbose logging

Example:

nfltr shell --password secret

nfltr terminal

Web-based terminal via tunnel (xterm.js, no WebSocket needed)

nfltr terminal [flags]

Flag	Default	Description
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--basic-auth user:password`	`$NFLTR_BASIC_AUTH`	require HTTP Basic Auth user:password
`--capability value`	—	additional capability identifier to advertise on the shared tunnel (repeatable, for example --capability terminal)
`--e2ee`	`true`	enable E2EE TLS termination (generates self-signed cert; clients connect via SNI router)
`--e2ee-cert file`	—	TLS certificate file for E2EE termination (implies --e2ee)
`--e2ee-key file`	—	TLS key file for E2EE termination (implies --e2ee)
`--http-addr address`	—	HTTP address of the relay for the --share API
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--labels key=value`	—	comma-separated key=value labels for fleet matching
`--name string`	`this machine's name`	agent identity
`--no-auth`	—	allow unauthenticated terminal access (use with caution)
`--no-share`	—	disable automatic share URL
`--retries attempts`	`12`	connection retry attempts
`--retry-wait seconds`	`5`	seconds between connection attempts once an outage passes a minute, doubling on repeated failures (a second at most before that)
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--share`	`true`	request a public share URL
`--shell command`	—	shell command to spawn (default: $SHELL or /bin/sh)
`--tcp-forward host:port`	—	optional local TCP host:port exposed through the same agent identity (for example localhost:22 or localhost:3389)
`--tls`	`true`	enable TLS for the gRPC connection
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client certificate file for mTLS
`--tls-key file`	—	client key file for mTLS

Example:

nfltr terminal --basic-auth admin:secret

nfltr ai

Remote AI CLI (Claude, Copilot) with text, voice & computer-use

nfltr ai [command] [args...] [flags]

Flag	Default	Description
`--api-key string`	—	API key for authentication
`--basic-auth user:password`	—	require HTTP Basic Auth user:password
`--cwd directory`	—	working directory for the AI CLI session
`--e2ee`	`true`	enable E2EE TLS termination
`--e2ee-cert file`	—	TLS certificate file for E2EE termination
`--e2ee-key file`	—	TLS key file for E2EE termination
`--http-addr address`	—	HTTP address of the relay for the --share API
`--key-name string`	—	use a named API key from config
`--labels key=value`	—	comma-separated key=value labels for fleet matching
`--mode mode`	`terminal`	UI mode: terminal (xterm.js) or chat
`--name string`	—	agent identity
`--no-auth`	—	allow unauthenticated access (use with caution)
`--no-share`	—	disable automatic share URL
`--retries attempts`	`12`	connection retry attempts
`--retry-wait seconds`	`5`	seconds between connection attempts once an outage passes a minute, doubling on repeated failures (a second at most before that)
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--share`	`true`	request a public share URL
`--tls`	`true`	enable TLS for the gRPC connection
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client certificate file for mTLS
`--tls-key file`	—	client key file for mTLS

Example:

nfltr ai --basic-auth admin:secret

Share text, a file, or stdin via an ephemeral URL

nfltr share [text|file|dir] [flags]

Tutorials: Share a local app · Share a log file or command output

Flag	Default	Description
`--acme-domain domain`	—	obtain Let's Encrypt certificate for domain (implies --e2ee; requires port 443 reachable)
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--basic-auth user:password`	`$NFLTR_BASIC_AUTH`	HTTP Basic Auth user:password
`--capability value`	—	additional capability identifier to advertise on the shared tunnel (repeatable, for example --capability terminal)
`--e2ee`	`true`	enable E2EE TLS termination (generates self-signed cert; clients connect via SNI router)
`--e2ee-cert file`	—	TLS certificate file for E2EE termination (implies --e2ee)
`--e2ee-key file`	—	TLS key file for E2EE termination (implies --e2ee)
`--expire duration`	—	end the share URL and this command after duration (e.g. 30m, 1h, 24h; the relay may cap it)
`--expires duration`	—	alias for --expire (end the share after duration)
`--file file`	—	path to file to share (mutually exclusive with stdin)
`--health-addr address`	`:29501`	health check HTTP endpoint address
`--http-addr address`	—	HTTP address of the relay for share and control-plane APIs
`--json`	—	emit share metadata as JSON {share_id, url, expires_at, size_bytes}
`--key-name string`	—	use a named API key from config
`--mode verified`	—	tunnel mode: verified or `inspectable` (preferred over --e2ee)
`--name string`	`this machine's name`	agent identity (auto-generated if omitted)
`--no-share`	—	disable automatic share URL
`--raw`	—	serve text as plain text (no HTML wrapper)
`--retries attempts`	`12`	connection retry attempts
`--retry-wait seconds`	`5`	seconds between connection attempts once an outage passes a minute, doubling on repeated failures (a second at most before that)
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--share`	`true`	request a public share URL after connecting (default: true)
`--share-auth user:password`	`$NFLTR_SHARE_AUTH`	HTTP Basic Auth user:password for share URL visitors
`--share-bearer token`	—	require Bearer token for share URL visitors
`--share-header Header=Value`	—	require HTTP Header=Value for share URL visitors (repeatable)
`--share-ip-allowlist IP/CIDR`	—	comma-separated IP/CIDR allowlist for share URL visitors
`--share-login`	—	share URL visitors must sign in to the relay's accounts as this machine's owner (or a --share-login-allow email); not with an agent certificate (--e2ee-cert, --acme-domain) or --mode passthrough
`--share-login-allow emails`	—	comma-separated emails a --share-login share also admits
`--share-preset public`	—	share workflow preset: public, `review`, or `webhook`
`--share-ttl duration`	—	how long the share URL lives without a visit, duration (for example 30m or 2h; default and cap: the relay's, 24h on nfltr.xyz); each visit starts it again
`--tcp-forward host:port`	—	optional local TCP host:port exposed through the same agent identity (for example localhost:22 or localhost:3389)
`--tls`	`true`	enable TLS for the gRPC connection
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client certificate file for mTLS
`--tls-key file`	—	client key file for mTLS

Example:

nfltr share "error: connection refused"

nfltr watch

Run a command periodically and stream output via share URL

nfltr watch [flags] <command> [args...]

Tutorials: Share a log file or command output

Flag	Default	Description
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--basic-auth user:password`	`$NFLTR_BASIC_AUTH`	HTTP Basic Auth user:password
`--capability value`	—	additional capability identifier to advertise on the shared tunnel (repeatable, for example --capability terminal)
`--e2ee`	`true`	enable E2EE TLS termination (generates self-signed cert; clients connect via SNI router)
`--e2ee-cert file`	—	TLS certificate file for E2EE termination (implies --e2ee)
`--e2ee-key file`	—	TLS key file for E2EE termination (implies --e2ee)
`--expire duration`	—	end the share URL and this command after duration (e.g. 30m, 1h; the relay may cap it)
`--health-addr address`	`:29501`	health check HTTP endpoint address
`--http-addr address`	—	HTTP address of the relay for the --share API
`--interval interval`	`2s`	refresh interval (e.g. 2s, 5s, 1m)
`--key-name string`	—	use a named API key from config
`--name string`	`this machine's name`	agent identity (auto-generated if omitted)
`--no-share`	—	disable share URL
`--retries attempts`	`12`	connection retry attempts
`--retry-wait seconds`	`5`	seconds between connection attempts once an outage passes a minute, doubling on repeated failures (a second at most before that)
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--share`	`true`	request a public share URL
`--share-auth user:password`	`$NFLTR_SHARE_AUTH`	HTTP Basic Auth user:password for share URL visitors
`--tcp-forward host:port`	—	optional local TCP host:port exposed through the same agent identity (for example localhost:22 or localhost:3389)
`--tls`	`true`	enable TLS for the gRPC connection
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client certificate file for mTLS
`--tls-key file`	—	client key file for mTLS

Example:

nfltr watch "kubectl get pods"

nfltr clipboard

Cross-machine clipboard sync via A2A messaging

nfltr clipboard <command> [flags]

Tutorials: Send files and messages between machines

Command	Description
`nfltr clipboard copy`	Send text, a file, stdin or your clipboard to a target's clipboard
`nfltr clipboard paste`	Fetch a target's clipboard (the target must allow it)
`nfltr clipboard listen`	Run on the target: receive copies (and serve pastes)

nfltr clipboard copy

Send text, a file, stdin or your clipboard to a target's clipboard

nfltr clipboard copy <target> [text]

Flag	Default	Description
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--e2ee-key-file file`	—	A2A end-to-end key file (default: this machine's <config dir>/a2a-root.key, else a2a-machine.key; the hub makes its root on first start, `nfltr orch hub machines add <machine> --out <file>` another machine's) (env NFLTR_A2A_E2EE_KEY_FILE)
`--file file`	—	read clipboard content from file instead of a positional argument
`--heartbeat-interval interval`	—	app-level A2A heartbeat send interval (e.g. 60s). 0 = use the rpcclient default (15s). The stall watchdog cancels the connection when sendLoop hasn't shipped any frame for 2× this interval; bump it on networks where docker NAT or HTTP/2 backpressure can stall sends past 30s (symptom: repeated `code = Canceled` flap every 30-90s).
`--keepalive preset`	—	how the agent notices a relay gone silent: preset default, fast, nat, datacenter, mobile, or interval=<duration>,timeout=<duration> (default: default, dead within 15s; NFLTR_KEEPALIVE)
`--keepalive-time interval`	—	gRPC client keepalive ping interval (e.g. 30s). 0 = use the rpcclient default (60s). At least 30s: relays end a connection pinged more often (GOAWAY too_many_pings); for faster detection use --keepalive.
`--keepalive-timeout timeout`	—	gRPC client keepalive ACK timeout. 0 = use the rpcclient default (20s). Lower values declare a connection dead faster after a real drop. Pair with --keepalive-time.
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--name string`	`this machine's name`	agent identity
`--peer string`	—	target agent name (alternative to the first argument)
`--retries attempts`	`12`	retry attempts
`--retry-wait seconds`	`5`	seconds between connection attempts once an outage passes a minute, doubling on repeated failures (a second at most before that)
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--timeout timeout`	`30s`	client-side send request timeout (e.g. 30s, 1m)
`--timeout-sec seconds`	`30`	request timeout in seconds (legacy; prefer --timeout)
`--tls`	`true`	enable TLS
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client cert file for mTLS
`--tls-key file`	—	client key file for mTLS

Example:

nfltr clipboard copy --peer work-laptop "some text"

nfltr clipboard paste

Fetch a target's clipboard (the target must allow it)

nfltr clipboard paste <target>

Flag	Default	Description
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--e2ee-key-file file`	—	A2A end-to-end key file (default: this machine's <config dir>/a2a-root.key, else a2a-machine.key; the hub makes its root on first start, `nfltr orch hub machines add <machine> --out <file>` another machine's) (env NFLTR_A2A_E2EE_KEY_FILE)
`--heartbeat-interval interval`	—	app-level A2A heartbeat send interval (e.g. 60s). 0 = use the rpcclient default (15s). The stall watchdog cancels the connection when sendLoop hasn't shipped any frame for 2× this interval; bump it on networks where docker NAT or HTTP/2 backpressure can stall sends past 30s (symptom: repeated `code = Canceled` flap every 30-90s).
`--json`	—	emit clipboard entry as JSON {content, peer, timestamp}
`--keepalive preset`	—	how the agent notices a relay gone silent: preset default, fast, nat, datacenter, mobile, or interval=<duration>,timeout=<duration> (default: default, dead within 15s; NFLTR_KEEPALIVE)
`--keepalive-time interval`	—	gRPC client keepalive ping interval (e.g. 30s). 0 = use the rpcclient default (60s). At least 30s: relays end a connection pinged more often (GOAWAY too_many_pings); for faster detection use --keepalive.
`--keepalive-timeout timeout`	—	gRPC client keepalive ACK timeout. 0 = use the rpcclient default (20s). Lower values declare a connection dead faster after a real drop. Pair with --keepalive-time.
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--name string`	`this machine's name`	agent identity
`--peer string`	—	target agent name (alternative to the first argument)
`--retries attempts`	`12`	retry attempts
`--retry-wait seconds`	`5`	seconds between connection attempts once an outage passes a minute, doubling on repeated failures (a second at most before that)
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--stdout`	—	print to stdout instead of writing to the system clipboard
`--timeout timeout`	`30s`	client-side send request timeout (e.g. 30s, 1m)
`--timeout-sec seconds`	`30`	request timeout in seconds (legacy; prefer --timeout)
`--tls`	`true`	enable TLS
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client cert file for mTLS
`--tls-key file`	—	client key file for mTLS

Example:

nfltr clipboard paste --peer work-laptop

nfltr clipboard listen

Run on the target: receive copies (and serve pastes)

nfltr clipboard listen [--allow-paste]

Flag	Default	Description
`--allow-paste clipboard paste`	—	also let agents on your account read this machine's clipboard with clipboard paste (off: copy only)
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--e2ee-key-file file`	—	A2A end-to-end key file (default: this machine's <config dir>/a2a-root.key, else a2a-machine.key; the hub makes its root on first start, `nfltr orch hub machines add <machine> --out <file>` another machine's) (env NFLTR_A2A_E2EE_KEY_FILE)
`--heartbeat-interval interval`	—	app-level A2A heartbeat send interval (e.g. 60s). 0 = use the rpcclient default (15s). The stall watchdog cancels the connection when sendLoop hasn't shipped any frame for 2× this interval; bump it on networks where docker NAT or HTTP/2 backpressure can stall sends past 30s (symptom: repeated `code = Canceled` flap every 30-90s).
`--keepalive preset`	—	how the agent notices a relay gone silent: preset default, fast, nat, datacenter, mobile, or interval=<duration>,timeout=<duration> (default: default, dead within 15s; NFLTR_KEEPALIVE)
`--keepalive-time interval`	—	gRPC client keepalive ping interval (e.g. 30s). 0 = use the rpcclient default (60s). At least 30s: relays end a connection pinged more often (GOAWAY too_many_pings); for faster detection use --keepalive.
`--keepalive-timeout timeout`	—	gRPC client keepalive ACK timeout. 0 = use the rpcclient default (20s). Lower values declare a connection dead faster after a real drop. Pair with --keepalive-time.
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--name string`	`this machine's name`	agent identity
`--retries attempts`	`12`	retry attempts
`--retry-wait seconds`	`5`	seconds between connection attempts once an outage passes a minute, doubling on repeated failures (a second at most before that)
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--timeout timeout`	`30s`	client-side send request timeout (e.g. 30s, 1m)
`--timeout-sec seconds`	`30`	request timeout in seconds (legacy; prefer --timeout)
`--tls`	`true`	enable TLS
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client cert file for mTLS
`--tls-key file`	—	client key file for mTLS

Example:

nfltr clipboard listen --name work-laptop

nfltr notify

Send desktop notifications between machines via A2A

nfltr notify <command> [flags]

Tutorials: Send files and messages between machines

Command	Description
`nfltr notify send`	Send a notification
`nfltr notify listen`	Listen for incoming notifications
`nfltr notify watch`	Notify when command finishes

nfltr notify send

Send a notification

nfltr notify send <target> <message>

Flag	Default	Description
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--e2ee-key-file file`	—	A2A end-to-end key file (default: this machine's <config dir>/a2a-root.key, else a2a-machine.key; the hub makes its root on first start, `nfltr orch hub machines add <machine> --out <file>` another machine's) (env NFLTR_A2A_E2EE_KEY_FILE)
`--heartbeat-interval interval`	—	app-level A2A heartbeat send interval (e.g. 60s). 0 = use the rpcclient default (15s). The stall watchdog cancels the connection when sendLoop hasn't shipped any frame for 2× this interval; bump it on networks where docker NAT or HTTP/2 backpressure can stall sends past 30s (symptom: repeated `code = Canceled` flap every 30-90s).
`--keepalive preset`	—	how the agent notices a relay gone silent: preset default, fast, nat, datacenter, mobile, or interval=<duration>,timeout=<duration> (default: default, dead within 15s; NFLTR_KEEPALIVE)
`--keepalive-time interval`	—	gRPC client keepalive ping interval (e.g. 30s). 0 = use the rpcclient default (60s). At least 30s: relays end a connection pinged more often (GOAWAY too_many_pings); for faster detection use --keepalive.
`--keepalive-timeout timeout`	—	gRPC client keepalive ACK timeout. 0 = use the rpcclient default (20s). Lower values declare a connection dead faster after a real drop. Pair with --keepalive-time.
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--name string`	`this machine's name`	agent identity
`--retries attempts`	`12`	retry attempts
`--retry-wait seconds`	`5`	seconds between connection attempts once an outage passes a minute, doubling on repeated failures (a second at most before that)
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--timeout timeout`	`30s`	client-side send request timeout (e.g. 30s, 1m)
`--timeout-sec seconds`	`30`	request timeout in seconds (legacy; prefer --timeout)
`--title title`	`nfltr`	notification title
`--tls`	`true`	enable TLS
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client cert file for mTLS
`--tls-key file`	—	client key file for mTLS

Example:

nfltr notify send work-laptop "Build finished!"

nfltr notify listen

Listen for incoming notifications

nfltr notify listen

Flag	Default	Description
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--e2ee-key-file file`	—	A2A end-to-end key file (default: this machine's <config dir>/a2a-root.key, else a2a-machine.key; the hub makes its root on first start, `nfltr orch hub machines add <machine> --out <file>` another machine's) (env NFLTR_A2A_E2EE_KEY_FILE)
`--heartbeat-interval interval`	—	app-level A2A heartbeat send interval (e.g. 60s). 0 = use the rpcclient default (15s). The stall watchdog cancels the connection when sendLoop hasn't shipped any frame for 2× this interval; bump it on networks where docker NAT or HTTP/2 backpressure can stall sends past 30s (symptom: repeated `code = Canceled` flap every 30-90s).
`--json`	—	emit received notification as JSON {title, body, source, timestamp}
`--keepalive preset`	—	how the agent notices a relay gone silent: preset default, fast, nat, datacenter, mobile, or interval=<duration>,timeout=<duration> (default: default, dead within 15s; NFLTR_KEEPALIVE)
`--keepalive-time interval`	—	gRPC client keepalive ping interval (e.g. 30s). 0 = use the rpcclient default (60s). At least 30s: relays end a connection pinged more often (GOAWAY too_many_pings); for faster detection use --keepalive.
`--keepalive-timeout timeout`	—	gRPC client keepalive ACK timeout. 0 = use the rpcclient default (20s). Lower values declare a connection dead faster after a real drop. Pair with --keepalive-time.
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--name string`	`this machine's name`	agent identity
`--retries attempts`	`12`	retry attempts
`--retry-wait seconds`	`5`	seconds between connection attempts once an outage passes a minute, doubling on repeated failures (a second at most before that)
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--timeout duration`	—	max wait duration before giving up (0 = wait forever)
`--timeout-sec seconds`	`30`	request timeout in seconds (legacy; prefer --timeout)
`--tls`	`true`	enable TLS
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client cert file for mTLS
`--tls-key file`	—	client key file for mTLS

Example:

nfltr notify listen --name my-laptop

nfltr notify watch

Notify when command finishes

nfltr notify watch <target> <command>

Flag	Default	Description
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--e2ee-key-file file`	—	A2A end-to-end key file (default: this machine's <config dir>/a2a-root.key, else a2a-machine.key; the hub makes its root on first start, `nfltr orch hub machines add <machine> --out <file>` another machine's) (env NFLTR_A2A_E2EE_KEY_FILE)
`--heartbeat-interval interval`	—	app-level A2A heartbeat send interval (e.g. 60s). 0 = use the rpcclient default (15s). The stall watchdog cancels the connection when sendLoop hasn't shipped any frame for 2× this interval; bump it on networks where docker NAT or HTTP/2 backpressure can stall sends past 30s (symptom: repeated `code = Canceled` flap every 30-90s).
`--keepalive preset`	—	how the agent notices a relay gone silent: preset default, fast, nat, datacenter, mobile, or interval=<duration>,timeout=<duration> (default: default, dead within 15s; NFLTR_KEEPALIVE)
`--keepalive-time interval`	—	gRPC client keepalive ping interval (e.g. 30s). 0 = use the rpcclient default (60s). At least 30s: relays end a connection pinged more often (GOAWAY too_many_pings); for faster detection use --keepalive.
`--keepalive-timeout timeout`	—	gRPC client keepalive ACK timeout. 0 = use the rpcclient default (20s). Lower values declare a connection dead faster after a real drop. Pair with --keepalive-time.
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--name string`	`this machine's name`	agent identity
`--retries attempts`	`12`	retry attempts
`--retry-wait seconds`	`5`	seconds between connection attempts once an outage passes a minute, doubling on repeated failures (a second at most before that)
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--timeout timeout`	`30s`	client-side send request timeout (e.g. 30s, 1m)
`--timeout-sec seconds`	`30`	request timeout in seconds (legacy; prefer --timeout)
`--title title`	`nfltr`	notification title
`--tls`	`true`	enable TLS
`--tls-ca file`	—	CA bundle file
`--tls-cert file`	—	client cert file for mTLS
`--tls-key file`	—	client key file for mTLS

Example:

nfltr notify watch work-laptop make test

nfltr config

Manage nfltr configuration (save API key, etc.)

nfltr config <command>

Tutorials: Getting started

Command	Description
`nfltr config login`	Sign in with your browser: enrol this machine in your account and save its key
`nfltr config add-api-key`	Save API key read from a prompt or stdin (optionally with a label)
`nfltr config set-relay`	Use your own relay (beta): its gRPC address, HTTPS URL, pinned certificate and, with -, its API key from stdin
`nfltr config list-api-keys`	List all saved API keys
`nfltr config use-api-key`	Switch the active API key
`nfltr config remove-api-key`	Remove a saved API key
`nfltr config check`	Validate configuration file
`nfltr config list`	Show current configuration
`nfltr config path`	Print configuration file path
`nfltr config client-key`	Print this machine's end-to-end client key fingerprint (made on first use): an agent serves pinned sessions only to the keys it lists with --allow-client

nfltr config login [--no-browser] [--machine name] [--name label]

Flag	Default	Description
`--machine string`	—	this machine's name in the account (lower-case letters, digits, '-'; default: one the relay makes, renamed with nfltr machines rename); dial its services as <machine>.<service>
`--name string`	—	label for the saved key (default: the machine id the relay returns)
`--no-browser`	—	print the sign-in URL instead of opening a browser (headless or remote shells)
`--timeout duration`	`10m0s`	how long to wait for the browser sign-in

Example:

nfltr config login --no-browser

nfltr config add-api-key

Save API key read from a prompt or stdin (optionally with a label)

nfltr config add-api-key [-] [--name label]

Example:

nfltr config add-api-key

nfltr config set-relay

Use your own relay (beta): its gRPC address, HTTPS URL, pinned certificate and, with -, its API key from stdin

nfltr config set-relay <host:port> --proxy-url URL [--cert-sha256 FP] [-] | --reset

Flag	Default	Description
`--cert-sha256 fingerprint`	—	SHA-256 fingerprint of the relay's self-signed certificate (nfltr relay serve prints it); omit for a CA-issued certificate
`--name label`	`relay`	label for the API key read with -
`--proxy-url url`	—	the relay's HTTPS url (nfltr relay serve prints it)
`--reset`	—	forget the saved relay (server, URL, pin): back to nfltr.xyz

Example:

nfltr config set-relay relay.lan:8443 --proxy-url https://relay.lan:8444 --cert-sha256 <fingerprint> - < admin-api-key

nfltr config list-api-keys

List all saved API keys

nfltr config list-api-keys

Flag	Default	Description
`--json`	—	Output as JSON
`--key-name string`	—	Only list the saved key with this label

Example:

nfltr config list-api-keys

nfltr config use-api-key

Switch the active API key

nfltr config use-api-key <label>

Example:

nfltr config use-api-key alice

nfltr config remove-api-key

Remove a saved API key

nfltr config remove-api-key <label>

Example:

nfltr config remove-api-key alice

nfltr config check

Validate configuration file

nfltr config check

Example:

nfltr config check

nfltr config list

Show current configuration

nfltr config list

Example:

nfltr config list

nfltr config path

Print configuration file path

nfltr config path

Example:

nfltr config path

nfltr config client-key

Print this machine's end-to-end client key fingerprint (made on first use): an agent serves pinned sessions only to the keys it lists with --allow-client

nfltr config client-key

Example:

nfltr config client-key

nfltr machine

Enrol this machine with a certificate; show its id, group and expiry

nfltr machine [enrol|status] ...

Command	Description
`nfltr machine enrol`	Make this machine's key here and get its certificate (the key never leaves the machine)
`nfltr machine status`	This machine's id, name, group and certificate expiry

nfltr machine enrol

Make this machine's key here and get its certificate (the key never leaves the machine)

nfltr machine enrol --code <code> | --token <file> --name <name>

Flag	Default	Description
`--code code`	—	the enrolment code the dashboard's Add machine shows
`--name name`	—	this machine's name (with --token)
`--oidc-token file`	—	file holding this workload's OIDC token (- reads stdin)
`--token file`	—	file holding a group enrolment token (- reads stdin)

Example:

nfltr machine enrol --code <code>

nfltr machine status

This machine's id, name, group and certificate expiry

nfltr machine status [--json]

Example:

nfltr machine status

nfltr machines

List, rename, move and revoke the account's machines

nfltr machines [list|rename|move|revoke] ...

Command	Description
`nfltr machines list`	List the account's machines: name, id, group
`nfltr machines rename`	Give a machine a new name (its id, agents and open sessions stay)
`nfltr machines move`	Move a machine to another group
`nfltr machines revoke`	Revoke a machine: its sessions are cut and its key refused

nfltr machines list

List the account's machines: name, id, group

nfltr machines list [--json]

Example:

nfltr machines list

nfltr machines rename

Give a machine a new name (its id, agents and open sessions stay)

nfltr machines rename <machine> <new name>

Example:

nfltr machines rename box1 build-01

nfltr machines move

Move a machine to another group

nfltr machines move <machine> <group>

Example:

nfltr machines move build-01 ci

nfltr machines revoke

Revoke a machine: its sessions are cut and its key refused

nfltr machines revoke <machine>

Example:

nfltr machines revoke build-01

nfltr groups

List the account's groups and reach rules; add and remove rules

nfltr groups [list|allow|remove-rule] ...

Command	Description
`nfltr groups list`	List groups and reach rules
`nfltr groups allow`	Let a group or a machine list or dial another group's machines
`nfltr groups remove-rule`	Remove a reach rule

nfltr groups list

List groups and reach rules

nfltr groups list [--json]

Example:

nfltr groups list

nfltr groups allow

Let a group or a machine list or dial another group's machines

nfltr groups allow <from group | machine> <to group> [list,dial]

Example:

nfltr groups allow ci prod dial

nfltr groups remove-rule

Remove a reach rule

nfltr groups remove-rule <rule id>

Example:

nfltr groups remove-rule <rule id>

nfltr status

Check server connectivity and agent list

nfltr status [flags]

Tutorials: Diagnostics

Flag	Default	Description
`--api-key string`	`$NFLTR_API_KEY`	API key (enables agent list)
`--json`	—	output as JSON (for scripting/CI)
`--quiet`	—	suppress info lines; print only the status summary
`--require-api-key`	—	exit 1 when no API key is available
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--tls`	`true`	server uses TLS

Example:

nfltr status

nfltr diagnose

Run connectivity diagnostics (DNS, TCP, TLS, gRPC)

nfltr diagnose [flags]

Tutorials: Diagnostics

Flag	Default	Description
`--json`	—	output as JSON (for scripting/CI)
`--quiet`	—	suppress progress output; print only a failure summary to stderr
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay gRPC address (host:port)
`--tls`	`true`	server uses TLS

Example:

nfltr diagnose

nfltr ssh-proxy

SSH ProxyCommand helper (tunnel SSH via the relay)

nfltr ssh-proxy --peer <agent> [--port <port>] [flags]

Tutorials: SSH to a machine behind NAT

Flag	Default	Description
`--api-key string`	`$NFLTR_API_KEY`	API key for authentication
`--json`	—	emit the session's events as JSON lines on stderr (as nfltr dial)
`--key-name string`	—	use a named API key from config (see 'nfltr config list-api-keys')
`--name string`	—	deprecated alias for --peer
`--no-tls`	—	disable TLS (sets --tls=false)
`--peer string`	—	agent identity (agentID) to connect to (required)
`--pin fingerprint`	—	end-to-end encrypt the session: TLS with the agent, whose E2EE certificate must have this SHA-256 fingerprint (as nfltr dial --pin); exit 7 on a mismatch
`--port string`	`22`	remote port (or service name) to tunnel to
`--server address`	`$NFLTR_SERVER, else grpc.nfltr.xyz:443`	relay address (host:port); grpc.<domain> is reached over HTTP at <domain>
`--tls`	`true`	use TLS for server connection

Example:

ssh -o ProxyCommand='nfltr ssh-proxy --peer %h --port %p' admin@my-server

nfltr ssh-config

Generate ~/.ssh/config entries for tunnel agents

nfltr ssh-config <agent-name> [flags]

Tutorials: SSH to a machine behind NAT

Flag	Default	Description
`--config file`	—	path to SSH config file (default: ~/.ssh/config)
`--identity IdentityFile`	—	SSH IdentityFile path (included in --json output)
`--insecure-skip-host-key-check`	—	turn off SSH host-key checking for this host (StrictHostKeyChecking no, no known_hosts); anyone on the tunnel path could impersonate the machine
`--json`	—	emit host_pattern, proxy_command, and identity_file as JSON
`--port port`	`22`	remote SSH port on the agent
`--print`	—	print the config block to stdout, don't modify files
`--remove`	—	remove the agent's Host block from SSH config
`--user username`	—	SSH username for the Host entry (default: current user)

Example:

nfltr ssh-config my-server --user admin

nfltr replay

Replay captured traffic against a local server

nfltr replay <capture-file> --target <url> [flags]

Flag	Default	Description
`--delay milliseconds`	—	milliseconds between requests (0 = as fast as possible)
`--dry-run`	—	print requests without executing them
`--json`	—	emit per-message status as JSON lines on stdout
`--method method`	—	only replay requests matching this HTTP method (e.g. GET, POST)
`--path substring`	—	only replay requests whose URL contains this substring
`--preserve-host`	—	send the original Host header
`--rate float`	—	max requests per second (0 = unlimited)
`--target URL`	—	base URL to replay requests against (required)
`--timeout seconds`	`30`	request timeout in seconds
`--verbose`	—	print response bodies

Example:

nfltr replay capture.json --target http://localhost:3000

nfltr demo

Demo scenarios, including a feature tour with copy-pasteable commands

nfltr demo [scenario] [flags]

Example:

nfltr demo

nfltr update

Self-update to the latest version

nfltr update [flags]

Example:

nfltr update --check

nfltr completion

Generate shell completion script (bash, zsh)

nfltr completion <bash|zsh>

Command	Description
`nfltr completion bash`	Generate bash completion
`nfltr completion zsh`	Generate zsh completion

nfltr completion bash

Generate bash completion

nfltr completion bash

Example:

eval "$(nfltr completion bash)"

nfltr completion zsh

Generate zsh completion

nfltr completion zsh

Example:

eval "$(nfltr completion zsh)"

nfltr version

Print version information

nfltr version [--json]

Flag	Default	Description
`--json`	—	emit structured build metadata as JSON

Example:

nfltr version

nfltr help

Show this help

nfltr help

Example:

nfltr help

Orchestration commands

The orchestration commands, nfltr orch and nfltr node, belong to the nfltr-orch binary, which nfltr runs for them. Their reference is on the orchestration site: orch.nfltr.xyz/docs/cli.

Authentication

nfltr supports multiple authentication methods, tried in order:

--api-key flag — highest priority
NFLTR_API_KEY environment variable
--key-name flag — look up a named key from config
Config file — active key in ~/.config/nfltr/nfltr.json
mTLS certificates — --tls-cert, --tls-key, --tls-ca

API Key Authentication

The server administrator creates API keys on the dashboard. Each key is bound to an agent identity.

# Save once (or save multiple keys with --name)
nfltr config add-api-key                       # prompts, no echo
nfltr config add-api-key - --name alice < keyfile
printf '%s' "$KEY" | nfltr config add-api-key -

# All subsequent commands use the active key automatically
nfltr http 8080
nfltr status

# Or use a specific named key per-command
nfltr http 8080 --key-name alice

mTLS Authentication

For zero-trust environments without API keys:

nfltr http 8080 \
  --tls-cert client.crt \
  --tls-key client.key \
  --tls-ca ca.crt \
  --server grpc.yourcompany.com:443

Agent identity is derived from the certificate Common Name (CN).

Features

Share URLs

Share URLs are enabled by default. Every nfltr http or nfltr command session automatically gets a temporary public URL with a random code (e.g., https://k3vq7mzt2xw4hn5rbsd6jyfa2e.nfltr.xyz/). Share URLs:

Are accessible without authentication
Use a random 26-character code as the subdomain
Expire when the agent disconnects
Are revoked automatically on disconnect

nfltr http 8080
# → Share URL: https://k3vq7mzt2xw4hn5rbsd6jyfa2e.nfltr.xyz/

# Disable with --no-share:
nfltr http 8080 --no-share

Multi-Backend Routing

Route different URL paths to different local services:

nfltr http 8080 \
  --route /api=3000 \
  --route /ws=4000 \
  --route /admin=https://localhost:9443

Path	Target
`/api/*`	`http://localhost:3000`
`/ws/*`	`http://localhost:4000`
`/admin/*`	`https://localhost:9443`
Everything else	`http://localhost:8080`

The prefix is stripped and the rest of the path is appended to the target's own path: /api/users reaches http://localhost:3000/users, and with --route /hook=http://localhost:9000/github, /hook/tasks reaches http://localhost:9000/github/tasks.

To expose only part of a service (for example one webhook endpoint), list the path prefixes to forward: nfltr http 8000 --allow-path /github. Any other path gets 404 from the agent and never reaches the service. Paths with .., // or an encoded slash are refused too. --allow-path turns off end-to-end TLS, because the agent must see each request.

Verbose Request Logging

With --verbose, every proxied request is logged:

[1] GET / → http://localhost:8080/ → 200 (4521 bytes, txn=abc123)
[2] GET /style.css → http://localhost:8080/style.css → 200 (1200 bytes, txn=def456)
[3] POST /api/login → http://localhost:3000/login → 200 (89 bytes, txn=ghi789)

Auto-Reconnect

nfltr automatically reconnects when the connection drops:

Default: 12 retry attempts with 5-second intervals
Configure: --retries 30 --retry-wait 10
Total resilience window: retries × retry-wait seconds

Duration Limit

Auto-stop after a fixed duration (useful for demos):

nfltr http 8080 --duration 3600  # Stop after 1 hour

Health Endpoint

nfltr exposes a local HTTP health endpoint (default :29501) for integration with monitoring tools:

nfltr http 8080 --health-addr :9999
# Health check: http://localhost:9999/health

Environment Variables

Variable	Description	Used By
`NFLTR_API_KEY`	API key	all commands
`NFLTR_SERVER`	Server gRPC address	all commands
`NFLTR_PROXY_URL`	Proxy API base URL	mcp
`NFLTR_CONFIG`	Config file path override	config, http, tcp
`AGENT_ID`	Agent identity	http, tcp
`RPC_TLS`	Enable TLS (`true`/`false`)	all commands
`TLS_CERT_FILE`	mTLS client certificate	http, tcp
`TLS_KEY_FILE`	mTLS client key	http, tcp
`TLS_CA_FILE`	mTLS CA bundle	http, tcp
`HEALTH_ADDR`	Health endpoint address	http
`REQUEST_TIMEOUT`	Request timeout (seconds)	http
`CONNECT_RETRIES`	Retry attempts	http, tcp
`RETRY_WAIT`	Retry interval (seconds)	http, tcp
`DURATION`	Max runtime (seconds)	http
`VERBOSE`	Verbose logging	http, tcp
`COMMAND_TIMEOUT`	Command execution timeout	command
`COMMAND_CWD`	Command working directory	command
`COMMAND_MODEL`	Default AI model	command
`NFLTR_BASIC_AUTH`	Basic auth credentials	command, http
`NFLTR_SHARE_AUTH`	Basic auth for share URL visitors	http
`NFLTR_SHARE_BEARER`	Bearer token for share URL visitors	http
`NFLTR_SHARE_IP_ALLOWLIST`	IP/CIDR allowlist for share URLs	http
`NFLTR_LABELS`	Comma-separated `key=value` labels	http, tcp, command
`SHARE`	Request a public share URL	http, command
`STUN_SERVER`	STUN server for NAT traversal	p2p
`A2A_TIMEOUT`	A2A request timeout (seconds)	a2a

Quick Command Map

Task	nfltr command
Expose HTTP	`nfltr http 8080`
Create a stable named endpoint	`nfltr http 8080 --name myapp`
Create a public share URL	`nfltr http 8080 --share`
Open a raw TCP tunnel from the agent	`nfltr tcp 22 --name my-ssh`
Expose a remote TCP service on localhost	`nfltr tcp-connect my-ssh 22 --listen :2222`
Route a path to a second local service	`nfltr http 8080 --route /api=3000`
Run connectivity diagnostics	`nfltr diagnose`
Save an API key locally	`nfltr config add-api-key`
Manage API keys	`nfltr keys generate` / `list` / `revoke`
Use NFLTR as SSH ProxyCommand	`nfltr ssh-proxy --peer %h --port %p`
Expose a CLI as an HTTP service	`nfltr command python3 myscript.py`
Send messages agent-to-agent	`nfltr a2a send` / `listen` / `pipe`
Send files or start a call peer-to-peer	`nfltr p2p send` / `recv` / `chat` / `call`
Give the hub a goal	`claude mcp add nfltr -- nfltr mcp --toolset hub`
Join this machine as a node	`nfltr node join --max-agents 2`
Check server status	`nfltr status`
Connect with mTLS	`nfltr http 8080 --tls-cert agent.crt --tls-key agent.key`